Transportation providers, businesses, banks and their customers work up to the worst kind of fire drill Friday morning: A global tech outage had knocked critical systems offline. What has already been deemed the largest IT outage in history isn’t the result of a cyberattack, but a faulty update. The outage impacted Windows 10 and later systems and did not impact Mac and Linux hosts.
CrowdStrike, a cybersecurity firm that provides antivirus protection for Microsoft Windows and other clients, said the error was due to an update related to its Falcon Sensor.
“We understand the gravity of the situation and are deeply sorry for the inconvenience and disruption. We are working with all impacted customers to ensure that systems are back up and they can deliver the services their customers are counting on,” Crowdstrike said in an update posted at 9:22 a.m. EDT.
Satya Nadella, CEO for Microsoft, posted a statement on X, “Yesterday, CrowdStrike released an update that began impacting IT systems globally. We are aware of this issue and are working closely with CrowdStrike and across the industry to provide customers technical guidance and support to safely bring their systems back online.”
Transit impacts
North American transit agencies have not experienced widespread service disruptions due to the outage. However, information systems and ticketing systems have been disrupted. Some transit providers are also reporting paratransit and/or flex trips that are reserved via a mobile app or by calling for a reservation could see delays.
Below is a snapshot of various impacts:
- Metropolitan Atlanta Rapid Transit Authority issued a tweet saying its website, Breeze card website and real-time service information was not available. However, bus rail and streetcar services are operating.
- Washington Metropolitan Area Transit Authority warned customers of potential delays during the early morning, but as of 5:45 a.m. EDT the authority said all Metrorail and buses are operating as scheduled. The authority restored its website and trip planning applications as of 9:30 a.m. EDT and noted Metro Access continues to experience minor delays.
- New Jersey Transit ticket vending machines (TVMs) “may be affected” by the global tech outage. The agency says customers impacted by this issue will not be denied travel until the TVMs are operational.
- Metropolitan Transportation Authority says some of its customer information systems were knocked offline due to the outage and are being restored. The authority notes service is not impacted but arrival times and elevator status may be inaccurate and encouraged customers to listen for announcements.
- Nassau Inter-County Express says some customers are experiencing malfunctions with its GoMobile app and advised its tech team was working on the issue.
One agency that was impacted by service disruptions was the Regional Transportation District (RTD) of Denver. Commuter rail service was unaffected, previous bus service impacts had been resolved and light-rail services "have been significantly impacted" due to outage of the Supervisory Control and Data Acquisition (SCADA) servers. The outage initially impacted real-time vehicle information, but this was restored around 8 a.m. MDT.
"Staff is closely working with RTD’s vendors to resolve the issue and restore service levels. At this time, RTD expects the disruption to last most of today but does not have an exact estimated time framefor the issue to be fully resolved. The outage has no impact on customer safety," the agency said.
The U.S. Department of Transportation is monitoring the situation as is the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
“CISA is aware of the widespread outage affecting Microsoft Windows hosts due to an issue with a recent CrowdStrike update and is working closely with Crowdstrike and federal, state, local, tribal and territorial (SLTT) partners, as well as critical infrastructure and international partners to assess impacts and support remediation efforts,” the agency said in an update this morning.
For more information on the impact of this outage, see our colleagues at SecurityInfoWatch.com's coverage.
